actually I want to capture all the arp-reply packets from all neighboring wireless networks, but when I try to do the same, no arp-reply packets from any networks are visible. Let me make you the scenario more clear, actually I have two network card, one of them is connected wirelessly to my phone's hotspot, and other card is in monitor mode and through this card I am trying to capture arp-packets using wireshark. But I am not able to see any arp-packets. To test this myself, using nping I generated arp-packets and sent it through the interface which is connected to internet and but didn't see any packets on wireshark which is listening in on card which is in monitor mode. So, finally my question is that, is it possible to listen arp-packets from other networks using the card which is in monitor mode??? Cuz, I failed doing this:(

  • First, does the wireless adapter and OS you are using actually provide support for capturing in monitor mode. If either are no, then you won't be able to do so. Second, you will only be able to capture ARP packets that are sent on an 802.11 network in the clear. Any encryption will prevent you from capturing ARP packets. – YLearn Aug 2 '18 at 0:26
  • Obviously, I am using Kali with latest 4.15 kernel version and alfaawus036ach is the adapter, they both support monitor mode, you may be knowing that. And secondly you said encrypted arp packets may not be captured, I don't know about actual arp-packets whether they are encrypted or not but the packets that I have crafted for testing purpose using nping , they are in plain text only and working on 802.11. So please help me – Shubham Dubey Aug 2 '18 at 2:38
  • ARP is a data payload in 802.11. If encryption is enabled on the 802.11 network, the data payload will be encrypted. Therefore, capturing ARP packets will fail because they will not appear as ARP packets, but as encrypted data payload. You will only be able to capture ARP packets transmitted "in the clear" or with no encryption. It is possible to capture all 802.11 packets, decrypt them (if you have the necessary information and captured frames), and then find the ARP packets. – YLearn Aug 2 '18 at 3:53
  • You may want to also reference aircrack-ng.blogspot.com/2017/08/… as there were some issues with that chipset (https://wikidevi.com/wiki/ALFA_Network_AWUS036ACH) and Kali depending on the drivers in use. Not sure if this is fixed as that was posted almost a year ago now. – YLearn Aug 2 '18 at 4:03
  • Thank You YLearn!!!, I got the concept, you are right about the arp-packet encryption as it is part of payload of ethernet packet. Thank you again:) – Shubham Dubey Aug 2 '18 at 17:07

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.